feat(sandbox): declare the network capability in the manifest

The manifest keeps asking for the network-policy control and the
egress.check operation, and now also declares capabilities.network with
the title the host uses in text. A test keeps the control working for a
manifest of the same shape that declares no network.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

addons/sandbox/manifest.json

@@ -18,6 +18,10 @@
       ]
     },
     "actions": true,
+    "network": {
+      "kind": "egress-check",
+      "title": "Sandbox"
+    },
     "toolDefinitions": [
       {
         "name": "bash",

pkg/addons/contract/network_test.go

@@ -3,6 +3,7 @@ package contract
 
 import (
 	"encoding/json"
+	"os"
 	"strings"
 
 	. "github.com/onsi/ginkgo/v2"
@@ -112,4 +113,25 @@ var _ = Describe("The network capability", func() {
 			Expect(none.PresetTitle("all", "All public sites")).To(Equal("All public sites"))
 		})
 	})
+
+	Describe("the shipped Sandbox manifest", func() {
+		load := func() Manifest {
+			b, err := os.ReadFile("../../../addons/sandbox/manifest.json")
+			Expect(err).NotTo(HaveOccurred())
+			m, err := ParseManifest(b)
+			Expect(err).NotTo(HaveOccurred())
+			return m
+		}
+		It("declares its network and keeps the control it asked for", func() {
+			m := load()
+			Expect(m.Capabilities.Network).To(Equal(&NetworkCapability{Kind: NetworkKindEgressCheck, Title: "Sandbox"}))
+			Expect(EntitledControls(m, []string{"egress."})).To(ContainElement(ControlNetworkPolicy))
+		})
+		It("keeps the control through its bash tool when an older manifest declares no network", func() {
+			m := load()
+			m.Capabilities.Network = nil
+			Expect(EntitledControls(m, []string{"egress."})).To(ContainElement(ControlNetworkPolicy))
+			Expect(EntitledControls(m, nil)).NotTo(ContainElement(ControlNetworkPolicy))
+		})
+	})
 })